Hook Check and Response

PreEmptive Protection™ DashO™ can inject checks into Android applications or libraries to detect hooking. The Hook Checks and Responses are configured on the Checks - Hook screen or by adding code annotations.

Hook Check

To detect hooking, place a HookCheck on one or more methods in your application. DashO adds code that performs several runtime hooking checks. This Check can be configured as described in the Overview.

An application can contain multiple uses of HookCheck with various configurations. Using more than one Check or mixing the Responses will hamper attackers.

private static boolean hookedFlag;

@HookCheck(action="@hookedFlag")
public void onCreate(Bundle check){

}

@HookCheck(response=ResponseType.Hang)
private int computeResult(){

}

Note: The Hook Check for Android requires access to the application's context; it expects a getApplicationContext() method to exist on the class where it is being injected. Classes extending android.context.Context, like android.app.Activity, android.app.Application, android.app.Service, etc. will inherit getApplicationContext(), and require no additional changes. Otherwise, you will need to add a getApplicationContext() method and make sure it returns a proper Context.

Hook Response

The HookResponse annotation interacts with the HookCheck. This Response can be configured as described in the Overview.

private static boolean hookedFlag;

@HookCheck(action="@hookedFlag")
public void onCreate(Bundle state){

}

@HookResponse(source="@hookedFlag", response=ResponseType.Exit, probability=0.05f)
private int computeResult(){

}

@HookResponse(source="@hookedFlag", response=ResponseType.Error, probability=0.1f)
private FileInputStream readInput(){

}