feat: rewrite Async API

Signed-off-by: Denis Dobanda <[email protected]>

s

Signed-off-by: Denis Dobanda <[email protected]>

Author: theDeniZ

Sources/ThreatDetectionCenter.swift

@@ -1,27 +1,90 @@
 import Foundation
+import Combine
 
 public final class ThreatDetectionCenter {
+    
+    private init() {}
+    
+    static private var delaySeconds = 10
+    
+    // MARK: - Async Threat Detection
+
+    // Private publisher for sending temperature updates
+    static private let reportPublisher = CurrentValueSubject<ThreatReport, Never>(ThreatReport())
+
+    static private var task: Task<(), Never>?
+    
+    /// Time to wait for cycle recheck threads before running check again
+    /// > Should be positive and greater than 0
+    static public var threatReportsRegenerationDelaySeconds: Int {
+        get { delaySeconds }
+        set { if newValue >= 1 { delaySeconds = newValue } }
+    }
+    
+    /// Use this API to get ThreatReports
+    ///
+    /// > First access will start Tasks and cache the result.
+    /// Next calls will not start any additional Tasks. Original result
+    /// will be cached and can be reused
+    static public var threatReports: AnyPublisher<ThreatReport, Never> {
+        if task != nil {
+            return reportPublisher.eraseToAnyPublisher()
+        }
+        task = Task {
+            Task {
+                repeat {
+                    let status = JailbreakDetector.threatDetected()
+                    reportPublisher.update { $0.copy(rootPrivileges: status) }
+                    await insertDelay()
+                } while !Task.isCancelled
+            }
+            Task {
+                repeat {
+                    let status = HooksDetector.threatDetected()
+                    reportPublisher.update { $0.copy(hooks: status) }
+                    await insertDelay()
+                } while !Task.isCancelled
+            }
+            Task {
+                let status = SimulatorDetector.threatDetected()
+                reportPublisher.update { $0.copy(simulator: status) }
+            }
+            Task {
+                repeat {
+                    let status = DebuggerDetector.threatDetected()
+                    reportPublisher.update { $0.copy(debugger: status) }
+                    await insertDelay()
+                } while !Task.isCancelled
+            }
+            Task {
+                repeat {
+                    let status = DevicePasscodeDetector.threatDetected()
+                    reportPublisher.update { $0.copy(devicePasscode: status) }
+                    await insertDelay()
+                } while !Task.isCancelled
+            }
+            Task {
+                let status = HardwareSecurityDetector.threatDetected()
+                reportPublisher.update { $0.copy(hardwareCryptography: status) }
+            }
+        }
+        return reportPublisher.eraseToAnyPublisher()
+    }
+    
+    // MARK: - Sync API
 
     /// Will check if jailbreak is present
     ///
-    /// - Returns:
-    ///  `true`, if device is / was jailbroken;
-    ///  `false` otherwise
-    ///
     /// More about jailbreak: https://wikipedia.org/wiki/Jailbreak_%28iOS%29
     ///
     /// > Should also detect jailbreak, even if the device is in a "safe" mode or
     /// jailbreak mode is not active / was not properly removed
-    public static var areRootPrivilegesDetected: Bool {
-        JailbreakDetection.threatDetected()
+    public static var rootPrivilegesStatus: ThreatStatus {
+        JailbreakDetector.threatDetected()
     }
 
     /// Will check for an injection tool like Frida
     ///
-    /// - Returns:
-    ///  `true`, if dynamic hooks are loaded at the time;
-    ///  `false` otherwise
-    ///
     /// More: https://fingerprint.com/blog/exploring-frida-dynamic-instrumentation-tool-kit/
     ///
     /// > By the nature of dynamic hooks, this checks should be made on a regular
@@ -30,45 +93,30 @@ public final class ThreatDetectionCenter {
     ///
     /// > Important: with a sufficient reverse engineering skills, this check can
     /// be disabled. Use always in combination with another threats detections.
-    public static var areHooksDetected: Bool {
-        HooksDetection.threatDetected()
+    public static var hooksStatus: ThreatStatus {
+        HooksDetector.threatDetected()
     }
 
     /// Will check, if the app runs in a emulated / simulated environment
-    ///
-    /// - Returns:
-    ///  `true`, if simulator environment is detected;
-    ///  `false` otherwise
-    public static var isSimulatorDetected: Bool {
-        SimulatorDetection.threatDetected()
+    public static var simulatorStatus: ThreatStatus {
+        SimulatorDetector.threatDetected()
     }
 
     /// Will check, if the application is being traced by a debugger.
     ///
-    /// - Returns:
-    ///   `true`, if a debugger is detected;
-    ///   `false`, if no debugger is detected;
-    ///   `nil`, if the detection process did not produce a definitive result.
-    ///   This could happen due to system limitations, lack of required
-    ///   permissions, or other undefined conditions.
-    ///
     /// A debugger is a tool that allows developers to inspect and modify the
     /// execution of a program in real-time, potentially exposing sensitive data
     /// or allowing unauthorized control.
     ///
     /// > Please note that Apple itself may require a debugger for the app review
     /// process.
-    public static var isDebuggerDetected: Bool? {
-        DebuggerDetection.threatDetected()
+    public static var debuggerStatus: ThreatStatus {
+        DebuggerDetector.threatDetected()
     }
 
     /// Will check, if current device is protected with at least a passcode
-    ///
-    /// - Returns:
-    ///  `true`, if device is unprotected;
-    ///  `false`, if device is protected with at least a passcode
-    public static var isDeviceWithoutPasscodeDetected: Bool {
-        DevicePasscodeDetection.threatDetected()
+    public static var devicePasscodeStatus: ThreatStatus {
+        DevicePasscodeDetector.threatDetected()
     }
 
     /// Will check, if current device has hardware protection layer
@@ -78,61 +126,34 @@ public final class ThreatDetectionCenter {
     ///
     /// More: https://developer.apple.com/documentation/security/protecting-keys-with-the-secure-enclave
     ///
-    /// - Returns:
-    ///  `true`, if device has no hardware protection;
-    ///  `false` otherwise
-    ///
     /// > Should be evaluated on a real device. Should only be used as an
     /// indicator, if current device is capable of hardware protection. Does not
     /// automatically mean, that encryption operations (keys, certificates,
     /// keychain) are always backed by hardware. You should make sure, such
     /// operations are implemented correctly with hardware layer
-    public static var isHardwareProtectionUnavailable: Bool {
-        HardwareSecurityDetection.threatDetected()
+    public static var hardwareCryptographyStatus: ThreatStatus {
+        HardwareSecurityDetector.threatDetected()
     }
-    
 
-	// MARK: - Async Threat Detection
-	
-	/// Defines all possible threats, that can be reported via the stream
-    public enum Threat: String {
-        case rootPrivileges
-        case hooks
-        case simulator
-        case debugger
-        case deviceWithoutPasscode
-        case hardwareProtectionUnavailable
+    // MARK: - Private API
+
+    static private func insertDelay() async {
+        try? await Task.sleep(nanoseconds: UInt64(delaySeconds) * NSEC_PER_SEC)
     }
-	
-	/// Stream that contains possible threats that could be detected
-    public static var threats: AsyncStream<Threat> {
-        AsyncStream<Threat> { continuation in
-            
-            if JailbreakDetection.threatDetected() {
-                continuation.yield(.rootPrivileges)
-            }
-            
-            if HooksDetection.threatDetected() {
-                continuation.yield(.hooks)
-            }
-            
-            if SimulatorDetection.threatDetected() {
-                continuation.yield(.simulator)
-            }
-            
-            if DebuggerDetection.threatDetected() ?? false {
-                continuation.yield(.debugger)
-            }
+}
 
-            if DevicePasscodeDetection.threatDetected() {
-                continuation.yield(.deviceWithoutPasscode)
+fileprivate extension CurrentValueSubject where Output: Equatable {
+    /// Use this function to update a value in the publisher atomically
+    func update(_ callback: (Output) -> Output) {
+        while true {
+            let value = self.value
+            let newValue = callback(value)
+            if value == newValue {
+                return
+            } else if self.value == value {
+                self.value = newValue
+                return
             }
-            
-            if HardwareSecurityDetection.threatDetected() {
-                continuation.yield(.hardwareProtectionUnavailable)
-            }
-
-            continuation.finish()
         }
     }
 }

Sources/ThreatReport.swift

@@ -0,0 +1,72 @@
+import Foundation
+
+/// An object describing latest detection status of every
+/// threat detectors
+public struct ThreatReport: Equatable, Hashable {
+    public let rootPrivileges: ThreatStatus
+    public let hooks: ThreatStatus
+    public let simulator: ThreatStatus
+    public let debugger: ThreatStatus
+    public let devicePasscode: ThreatStatus
+    public let hardwareCryptography: ThreatStatus
+    
+    public init(
+        rootPrivileges: ThreatStatus = .notChecked,
+        hooks: ThreatStatus = .notChecked,
+        simulator: ThreatStatus = .notChecked,
+        debugger: ThreatStatus = .notChecked,
+        devicePasscode: ThreatStatus = .notChecked,
+        hardwareCryptography: ThreatStatus = .notChecked
+    ) {
+        self.rootPrivileges = rootPrivileges
+        self.hooks = hooks
+        self.simulator = simulator
+        self.debugger = debugger
+        self.devicePasscode = devicePasscode
+        self.hardwareCryptography = hardwareCryptography
+    }
+    
+    func copy(
+        rootPrivileges: ThreatStatus? = nil,
+        hooks: ThreatStatus? = nil,
+        simulator: ThreatStatus? = nil,
+        debugger: ThreatStatus? = nil,
+        devicePasscode: ThreatStatus? = nil,
+        hardwareCryptography: ThreatStatus? = nil
+    ) -> ThreatReport {
+        return ThreatReport(
+            rootPrivileges: rootPrivileges ?? self.rootPrivileges,
+            hooks: hooks ?? self.hooks,
+            simulator: simulator ?? self.simulator,
+            debugger: debugger ?? self.debugger,
+            devicePasscode: devicePasscode ?? self.devicePasscode,
+            hardwareCryptography: hardwareCryptography ?? self.hardwareCryptography
+        )
+    }
+}
+
+public enum ThreatStatus: Equatable, Hashable {
+    case notChecked
+    case notPresent
+    case present
+    case exception(ThreatDetectionException)
+    
+    public static func ==(lhs: ThreatStatus, rhs: ThreatStatus) -> Bool {
+        switch (lhs, rhs) {
+        case (.notChecked, .notChecked):
+            return true
+        case (.notPresent, .notPresent):
+            return true
+        case (.present, .present):
+            return true
+        case (.exception(let s1), .exception(let s2)):
+            return s1 == s2
+        default:
+            return false
+        }
+    }
+}
+
+public enum ThreatDetectionException: Error, Equatable, Hashable {
+    case checkNotPossible(String)
+}

Sources/internal/DebuggerDetection.swift

@@ -0,0 +1,37 @@
+import Foundation
+
+// MARK: - Internal
+internal final class DebuggerDetector {
+    
+    static func threatDetected() -> ThreatStatus {
+        do {
+            let check = try hasTracerFlagSet()
+            return check ? .present : .notPresent
+        } catch let e {
+            let ex = e as? ThreatDetectionException
+                ?? ThreatDetectionException.checkNotPossible(e.localizedDescription)
+            return .exception(ex)
+        }
+    }
+}
+
+// MARK: - Private
+fileprivate extension DebuggerDetector {
+    
+    /// Check P_TRACED flag from Darwin Kernel
+    /// if the process is traced
+    private static func hasTracerFlagSet() throws -> Bool {
+        var info = kinfo_proc()
+        // Kernel info, process info, specific process by PID, get current process ID
+        var mib: [Int32] = [CTL_KERN, KERN_PROC, KERN_PROC_PID, getpid()]
+        var size = MemoryLayout.stride(ofValue: info)
+        
+        let unixStatusCode = sysctl(&mib, u_int(mib.count), &info, &size, nil, 0)
+        
+        if unixStatusCode != 0 {
+            throw ThreatDetectionException.checkNotPossible("Unexpected unix status code")
+        }
+        
+        return (info.kp_proc.p_flag & P_TRACED) != 0
+    }
+}